Synopsis
Apache Solr 6.x < 6.4.1 Directory Traversal
Description
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. Solr versions < 5.5.4 and 6.x < 6.4.1 do not validate this file name allowing for a remote, unauthenticated attacker to access any file(s) readable by the Solr application.
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update to Apache Solr version 6.4.1 or latest.